CVEvulnerability
CVE-2021-42372
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-11-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service.
Affected configurations
• xorux lpar2rrd (< 7.30)
• xorux stor2rrd (< 7.30)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-xfw3-pgp3-5j2p Exploit, Third Party Advisory
- https://lpar2rrd.com/note730.php Release Notes, Vendor Advisory
- https://stor2rrd.com/note730.php Release Notes, Vendor Advisory
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-xfw3-pgp3-5j2p Exploit, Third Party Advisory
- https://lpar2rrd.com/note730.php Release Notes, Vendor Advisory
- https://stor2rrd.com/note730.php Release Notes, Vendor Advisory